From: Scott Call (no email)
Date: Tue Oct 01 2002 - 13:01:53 EDT
On Tue, 1 Oct 2002, fingers wrote:
>
> hi
>
> I might be totally off the mark here, but has slapper now changed to port
> 1812? This'll make it really difficult to filter, if you're using this
> port for RADIUS.
>
We saw this yesterday, directed at a previously infected slapper.a
(2002/udp backchannel) host on a a customer's network, and I sent the
captured info to CERT to see what they made of it.
I didn't know if it was the slapper communications channel, or one of the
triggered DDOSs from slapper.
-S
|
|
|